Faulty Assumptions: Why Intelligence Sharing Fails
summary
Claim: intelligence sharing fails because three faulty assumptions drive programs — that CTI is only technical, that everyone should share the same technical feeds, and that hooking up pipelines is sufficient. Experience running the Cyber Threat Alliance shows practical fixes: classify CTI into four tiers — technical, tactical, operational, strategic, focus sharing by relevance and comparative advantage, adopt standards for nontechnical data, and fund sustained programs that build trust money time attention; CTA’s nonprofit model proves sustained, tailored sharing can work.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:01Information Sharing's Faulty Assumptions
- 5:20Categories of Cyber Threat Information
- 7:24Types of Cyber Threat Information
- 10:26Relevance Drives Utility
- 12:03Comparative Advantage Should Drive Action
- 17:11Implications of Revised Assumptions (5-8)
- 21:09Applying The Revised Assumptions Revised Assumption Action
- 23:08Applying the Revised Assumptions - Organizational Leaders Ask what threat information would help your business
- 24:48Applying the Revised Assumptions - Company Cyber Teams
- 25:56Applying the Revised Assumptions - Security Providers
- 27:22Applying the Revised Assumptions - Governments
related talks
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
32mTen Years of Cyber Threat Intelligence: Retrospectives
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
41mThe Art of Threat-Informed Sharing: Real-life Use Cases from NSA
26mEvaluating Threat Intelligence Through Velocity
51mUsing Critical Threat Intelligence Strategically
32mIntelligence Sharing for Critical Infrastructure Resiliency
01mQuick Look: These Aren't the Threats You're Looking For: How Our APT Focus Ruins CTI